#FactCheck- Delhi Metro Rail Corporation Price Hike

Executive Summary:

This report deals with a recent cyberthreat that took the form of a fake message carrying a title of India Post which is one of the country’s top postal services. The scam alerts recipients to the failure of a delivery due to incomplete address information and requests that they click on a link (http://iydc[.]in/u/5c0c5939f) to confirm their address. Privacy of the victims is compromised as they are led through a deceitful process, thereby putting their data at risk and compromising their security. It is highly recommended that users exercise caution and should not click on suspicious hyperlinks or messages.

False Claim:

The fraudsters send an SMS stating the status of delivery of an India Mail package which could not be delivered due to incomplete address information. They provide a deadline of 12 hours for recipients to confirm their address by clicking on the given link (http://iydc[.]in/u/5c0c5939f). This misleading message seeks to fool people into disclosing personal information or compromising the security of their device. 

‍

‍

The Deceptive Journey:

• First Contact: The SMS is sent and is claimed to be from India Post, informs users that due to incomplete address information the package could not be delivered.

• Recipients are then expected to take action by clicking on the given link (http://iydc[.]in/u/5c0c5939f) to update the address. The message creates a panic within the recipient as they have only 12 hours to confirm their address on the suspicious link.

• Click the Link: Inquiring or worried recipients click on the link.

• User Data: When the link is clicked, it is suspected to  launch possible remote scripts in the background and collect personal information from users.

• Device Compromise: Occasionally, the website might also try to infect the device with malware or take advantage of security flaws.

The Analysis:

• Phishing Technique: The scam allures its victims with a phishing technique and poses itself as the India Post Team, telling the recipients to click on a suspicious link to confirm the address as the delivery package can’t be delivered due to incomplete address. 
• Fake Website Creation: Victims are redirected to a fraudulent website when they click on the link (http://iydc[.]in/u/5c0c5939f) to update their address.
• Background Scripts: Scripts performing malicious operations such as stealing the visitor information, distributing viruses are suspected to be running in the background. This script can make use of any vulnerability in the device/browser of the user to extract more info or harm the system security.
• Risk of Data Theft: This type of fraud has the potential to steal the data involved because it lures the victims into giving their personal details by creating fake urgency. The threat actors  can use it for various illegal purposes such as financial fraud, identity theft and other criminal purposes in future.
• Domain Analysis: The iydc.in domain was registered on the 5th of April, 2024, just a short time ago. Most of the fraud domains that are put up quickly and utilized in criminal activities are usually registered in a short time.
• Registrar: GoDaddy.com, LLC, a reputable registrar, through which  the domain is registered. 
• DNS: Chase.ns.cloudflare.com and delilah.ns.cloudflare.com are the name servers used by Cloudflare to manage domain name resolution. 
• Registrant: Apart from the fact that it is in Thailand, not much is known about the registrant probably because of using the privacy reduction plugins. 

• Domain Name: iydc.in
• Registry Domain ID: DB3669B210FB24236BF5CF33E4FEA57E9-IN
• Registrar URL: www.godaddy.com
• Registrar: GoDaddy.com, LLC
• Registrar IANA ID: 146
• Updated Date: 2024-04-10T02:37:06Z
• Creation Date: 2024-04-05T02:37:05Z (Registered in very recent time)
• Registry Expiry Date: 2025-04-05T02:37:05Z
• Registrant State/Province: errww
• Registrant Country: TH (Thailand)
• Name Server: delilah.ns.cloudflare.com
• Name Server: chase.ns.cloudflare.com

Note: Cybercriminals used Cloudflare technology to mask the actual IP address of the fraudulent website.

CyberPeace Advisory:

• Do not open the messages received from social platforms in which you think that such messages are suspicious or unsolicited. In the beginning, your own discretion can become your best weapon.
• Falling prey to such scams could compromise your entire system, potentially granting unauthorized access to your microphone, camera, text messages, contacts, pictures, videos, banking applications, and more. Keep your cyber world safe against any attacks.
• Never reveal sensitive data such as your login credentials and banking details to entities where you haven't validated as reliable ones.
• Before sharing any content or clicking on links within messages, always verify the legitimacy of the source. Protect not only yourself but also those in your digital circle.
• Verify the authenticity of alluring offers before taking any action.
  

Conclusion:

The India Post delivery scam is an example of fraudulent activity that uses the name of trusted postal services to trick people. The campaign is initiated by using deceptive texts and fake websites that will trick the recipients into giving out their personal information which can later be used for identity theft, financial losses or device security compromise. Technical analysis shows the sophisticated tactics used by fraudsters through various techniques such as phishing, data harvesting scripts and the creation of fraudulent domains with less registration history etc.  While encountering such messages, it's important to verify their authenticity from official sources and take proactive measures to protect both your personal information and devices from cyber threats. People can reduce the risk of falling for online scams by staying informed and following cybersecurity best practices.

‍

Introduction

Search engines have become indispensable in our daily lives, allowing us to find information instantly by entering keywords or phrases. Using the prompt "search Google or type a URL" reflects just how seamless this journey to knowledge has become. With millions of searches conducted every second, and Google handling over 6.3 million searches per minute as of 2023 (Statista), one critical question arises: do search engines prioritise results based on user preferences and past behaviours, or are they truly unbiased?

Understanding AI Bias in Search Algorithms

AI bias is also known as machine learning bias or algorithm bias. It refers to the occurrence of biased results due to human biases that deviate from the original training data or AI algorithm which leads to distortion of outputs and creation of potentially harmful outcomes. The sources of this bias are algorithmic bias, data bias and interpretation bias which emerge from user history, geographical data, and even broader societal biases in training data. 

Common biases include excluding certain groups of people from opportunities because of AI bias. In healthcare, underrepresenting data of women or minority groups can skew predictive AI algorithms. While AI helps streamline the automation of resume scanning during a search to help identify ideal candidates, the information requested and answers screened out can result in biased outcomes due to a biased dataset or any other bias in the input data.

Case in Point: Google’s "Helpful" Results and Its Impact 

Google optimises results by analysing user interactions to determine satisfaction with specific types of content. This data-driven approach forms ‘filter bubbles’ by repeatedly displaying content that aligns with a user’s preferences, regardless of factual accuracy. While this can create a more personalised experience, it risks confining users to a limited view, excluding diverse perspectives or alternative viewpoints.

The personal and societal impacts of such biases are significant. At an individual level, filter bubbles can influence decision-making, perceptions, and even mental health. On a societal level, these biases can reinforce stereotypes, polarise opinions, and shape collective narratives. There is also a growing concern that these biases may promote misinformation or limit users’ exposure to diverse perspectives, all stemming from the inherent bias in search algorithms.

Policy Challenges and Regulatory Measures

Regulating emerging technologies like AI, especially in search engine algorithms, presents significant challenges due to their intricate, proprietary nature. Traditional regulatory frameworks struggle to keep up with them as existing laws were not designed to address the nuances of algorithm-driven platforms. Regulatory bodies are pushing for transparency and accountability in AI-powered search algorithms to counter biases and ensure fairness globally. For example, the EU’s Artificial Intelligence Act aims to establish a regulatory framework that will categorise AI systems based on risk and enforces strict standards for transparency, accountability, and fairness, especially for high-risk AI applications, which may include search engines. India has proposed the Digital India Act in 2023 which will define and regulate High-risk AI. 

Efforts include ethical guidelines emphasising fairness, accountability, and transparency in information prioritisation. However, a complex regulatory landscape could hinder market entrants, highlighting the need for adaptable, balanced frameworks that protect user interests without stifling innovation.

CyberPeace Insights

In a world where search engines are gateways to knowledge, ensuring unbiased, accurate, and diverse information access is crucial. True objectivity remains elusive as AI-driven algorithms tend to personalise results based on user preferences and past behaviour, often creating a biased view of the web. Filter bubbles, which reinforce individual perspectives, can obscure factual accuracy and limit exposure to diverse viewpoints. Addressing this bias requires efforts from both users and companies. Users should diversify sources and verify information, while companies should enhance transparency and regularly audit algorithms for biases. Together, these actions can promote a more equitable, accurate, and unbiased search experience for all users. 

References 

• https://www.bbc.com/future/article/20241101-how-online-photos-and-videos-alter-the-way-you-think 
• https://www.bbc.com/future/article/20241031-how-google-tells-you-what-you-want-to-hear
• https://www.ibm.com/topics/ai-bias#:~:text=In%20healthcare%2C%20underrepresenting%20data%20of,can%20skew%20predictive%20AI%20algorithms

‍

Introduction

‍
India currently faces a crucial moment because its digital system experiences rapid growth while cyber criminals take advantage of this development to increase their fraudulent activities. The Department of Telecommunications (DoT) has implemented a new regulatory requirement that mandates all messaging and communication platforms to use SIM-binding technology as their primary security measure. The new rule, which starts on 1st March 2026, requires WhatsApp, Telegram, Signal and other similar applications to operate only when users have their registered SIM card present in their device. The telecom identifier restriction aims to prevent unauthorised access, but it creates significant privacy concerns, together with issues of proportionality and platform governance.

‍

Understanding the SIM-Binding Directive

‍

SIM-binding establishes direct links between communication platform accounts and the SIM cards used for registration. The application will stop working when users take out their SIM card, turn it off, or get a new SIM card. Users must re-authenticate their sessions through the main device because web-based sessions, including WhatsApp Web, will automatically log out after six hours of use. 

The Telecommunications Act, 2023 and Telecom Cyber Security Rules serve as the base legal authority for this directive. The regulation requires Telecommunication Identity User Entities (TIUEs), which identify users through mobile numbers, to maintain service access based on verified telecommunications credentials.

‍

Rationale: Addressing Cyber Fraud and Misuse

‍
The policy exists because cyber fraud activities have reached a point where they require a more powerful response. Authorities have stated that messaging applications maintain their operational capacity even after users remove their SIM cards, which allows international scammers to use Indian phone numbers for their fraudulent activities. SIM-binding aims to: 

• Restore traceability by linking active accounts to verified SIM-based identities.
• Reduce remote access abuse, which includes both account takeovers and impersonation scams.
• Stop fraudulent activities that require physical device access through the creation of permanent sessions.
• Build a system of accountability that extends throughout the telecommunications industry.

The government introduced this measure as an appropriate solution to deal with systemic vulnerabilities because reported cyber fraud losses in 2024 reached more than ₹22,800 crore.

‍

Security with Responsibility

‍

‍The system requires digital trust to be established through secure identity verification systems, which include official systems for verification and operational systems that enable governmental agencies to work together. 

CyberPeace principles require security measures to maintain three essential conditions, which are:

• They must respond to existing dangers 
• Their execution process must be open to public observation 
• They need to protect user rights, which include their right to privacy and personal independence 
• They must provide equal access while safeguarding against negative impacts on at-risk user groups. 

‍

Industry Response and Governance Challenges

‍
The directive has received diverse responses from people who work in different fields. Some platforms are testing SIM presence verification features for their upcoming changes, according to reports, while industry groups representing major technology companies have raised legal issues. They argue that the mandate may exceed the regulatory scope of the DoT and potentially conflict with constitutional protections. The existing tension demonstrates how governments face difficulties because they must protect national security while managing international platform operations and legal systems. The situation requires multiple stakeholders to work together because governments, industry, and civil society need to design policies through their collective input.

‍

Policy Insights and Recommendations

‍
The successful balanced execution of this initiative depends on these two essential elements:

1. Clear Implementation Guidelines: Organizations need to establish detailed technical standards together with compliance frameworks, which must be followed during their implementation process across various platforms. 
2. Privacy Safeguards: The telecom service provider must implement strong data protection measures that protect customer data from unauthorised access through SIM-binding technology. 
3. User Awareness and Transparency: Users should receive information about SIM-binding effects on their access rights, together with security controls, which will help them build trust and provide informed consent. 
4. Flexibility for Edge Cases: Provisions should exist for legitimate use cases such as device changes, international travel, and accessibility needs. 
5. Global Interoperability Dialogue: India should engage with global stakeholders to ensure that such measures do not fragment the digital ecosystem.

‍

Conclusion

‍
The SIM-binding directive establishes India’s defence against cyber threats by solving a specific problem that exists in digital identity verification. The system establishes CyberPeace as its fundamental base through its shift from reactive cybersecurity practices toward preventive digital governance methods. 

The system will achieve its desired results only if it effectively manages the three elements of security protection, privacy maintenance, and user convenience. SIM-binding and similar policies require ongoing assessment because their implementation affects both national security and the fundamental principles of trustworthiness, inclusiveness, and ethical digital governance.

‍

References

‍

• https://www.opindia.com/2026/02/sim-binding-to-be-implemented-from-1st-march-what-it-means-and-how-it-will-impact-users/
• https://www.ndtv.com/india-news/sim-binding-rule-set-to-change-how-whatsapp-telegram-work-in-india-from-march-1-11148903#:~:text=Under%20the%20new%20framework%2C%20messaging,is%20re%2Dinserted%20and%20authenticated.
• https://timesofindia.indiatimes.com/technology/tech-news/telecom-departments-sim-binding-rule-to-come-into-effect-from-tomorrow-march-1-what-is-sim-binding-how-it-works-and-what-it-means-for-whatsapp-users/articleshow/128879561.cms
• https://www.deccanherald.com/technology/whatsapp-begins-testing-sim-binding-in-india-3913963

‍